Trust Just Changed the Salesforce Landscape
In today’s Salesforce environment, trust and security have never been more paramount. Recent incidents have made clear that even widely adopted integrations can introduce material, often invisible, risk.
In August 2025, for example, attackers abused stolen OAuth tokens from a popular sales engagement app (integrated via Salesforce’s Connected Apps) to silently access data in hundreds of orgs – all without triggering multi-factor authentication.
Just a few months later, Salesforce detected unusual activity originating from a customer success app’s integration, prompting a swift security advisory: it revoked all tokens for that app and removed it from the AppExchange after finding evidence of OAuth abuse that enabled unauthorized API calls. Importantly, neither incident reflected a vulnerability in Salesforce’s core platform. Both exposed a subtler weakness: unexamined trust in third-party connected applications and their access tokens.
For enterprise leaders and security teams, the message is clear: the Salesforce ecosystem’s extended integrations can silently become a double-edged sword. They power business productivity, but if not tightly governed by proactive security teams, they can become invisible doors for devastating data breaches. In the wake of these OAuth token breaches, the entire Salesforce community – from executives to admins – must reevaluate what “secure” means when allowing third-party app access.
Learning from the OAuth Token Crisis
The recent OAuth-related security incidents serve as a cautionary tale and a catalyst for change. When threat actors leverage legitimate Connected App tokens to bypass security measures, it exposes a blind spot in many organizations’ defenses: third-party apps are often granted broad trust by default.
An attacker no longer needs to breach Salesforce directly when they can operate through an application your organization has already approved. In one incident, a legitimate integration’s OAuth token effectively became a master key, enabling data export across more than 700 Salesforce customers without a login prompt. Salesforce ultimately took the unprecedented step of invalidating the app’s access across all affected customers.
These events underscore a critical shift in the threat model. Security in the Salesforce ecosystem must extend beyond users and permissions to include every non-human identity — each connected app, token, and integration path. For Salesforce administrators and IT leaders alike, the conclusion is unavoidable: broad or poorly monitored integrations now represent one of the highest-impact risk vectors in the platform.
Salesforce Locks the Doors on Untrusted Apps
The Salesforce response has been swift and decisive. The Salesforce Trust team and product leaders introduced new Connected App usage restrictions designed to give administrators explicit control over which applications may access their environments.
Since September 2025, any connected app that is not explicitly installed and approved within an org is blocked by default.
For everyday users, the era of casually connecting third-party apps has effectively ended — a necessary shift in a more hostile security environment. Combined with Salesforce’s guidance on auditing OAuth usage and revoking unused or untrusted connections, these changes reinforce a platform-wide “trust-first” posture.
The implication for enterprise teams is clear: governing integrations is no longer optional. Responsible Salesforce management now requires the same rigor applied to apps and tokens as to users, roles, and permissions. Technology leaders must ask a harder question than before: Can we enable meaningful functionality without expanding our current—and future—attack surface?
Looking ahead, Salesforce is doubling down on this ‘trust-first’ architecture by transitioning from legacy Connected Apps to the more secure External Client App (ECA) framework. Starting in Spring ‘26, the creation of new Connected Apps will be disabled by default. This transition is a critical step toward standardizing more granular security controls and preventing the types of OAuth abuse that have historically plagued third-party integrations. For ISVs and customers alike, the shift to ECAs represents a mandatory evolution toward a more defensible, governed integration model.
Why 100% native apps deliver peace of mind
Amid the rising tide of integration-based attacks, 100% native AppExchange applications offer a materially lower-risk alternative. From the outset, RealZips was built entirely within the Salesforce Cloud, operating exclusively inside customer orgs. It requires no external servers, no mirrored data stores, no OAuth tokens, and no off-platform credentials to function.
100% native apps are the building blocks of your Salesforce fortress
⎯ Corey Kleinbauer
Why does this distinction matter so much today — and even more tomorrow?
The recent incidents all shared common risk vectors: external OAuth tokens, third-party middleware, and data flows operating beyond Salesforce’s direct control.
Native applications eliminate those vectors by design. Because they run entirely within Salesforce, they introduce no external authentication paths, no off-platform APIs, and no independent infrastructure to secure. There is no external system to breach, because no external system exists.
For security teams, this translates into a simpler and more defensible posture. Functionality remains fully subject to Salesforce’s existing monitoring, compliance, and governance controls. In an environment where even well-intentioned integrations are being weaponized, native architecture is no longer merely convenient — it is strategic.
No Tokens, No Data Transfers: Eliminating Entire Classes of Risk
A closer look at how native AppExchange apps reduce exposure:
- No OAuth Tokens: Truly native applications do not rely on separate connected-app authentication. There is no external process logging into Salesforce via the API; therefore, there is no token to steal, reuse, or abuse.
- No External Data Flows: All application logic and data reside in Salesforce objects within the customer’s own instance. Unlike architectures that export or mirror data to external systems for processing, native apps keep sensitive information in-platform.
- No Middleware or Separate Infrastructure: Native apps eliminate the need for additional servers, cloud services, or background sync processes. Organizations avoid the operational and security burden of securing systems they do not directly control.
- Platform Level Performance and Reliability: Because native apps execute entirely within Salesforce, performance and availability align with the platform itself. There are no API round-trips, no sync delays, and no dependency on third-party uptime. These applications function as first-class Salesforce features — usable across Flows, reporting, dashboards, and Agentforce.
In aggregate, this architecture reflects a security-first principle: minimize the number of attack surfaces that attackers can exploit.
Native Apps and Operational Advantage
Security is foundational, and native architecture and native AppExchange apps deliver operational benefits.
David VanHeulekom, a serial entrepreneur and Salesforce ISV advisor, summarizes native apps:
- Data Security & Compliance: Your data never leaves Salesforce; it inherits Salesforce’s security, scalability, and trust.
- User Experience & Adoption: Native (In the Flow of Work): No context switching.
- Real-Time Insights: Data lives in Salesforce, instant data access, no sync delays.
- Salesforce Platform Integration: Leverage custom objects, flows, search, reporting, analytics, mobile, and Agentforce.
- Native Interoperability: Seamless cross-app integration with other native AppExchange applications.
Start minimizing your risk exposure now
The most significant emerging risk for Salesforce organizations is no longer user access alone, but agentic and automated access enabled through third-party applications. As AI-driven tools accelerate data extraction and decision-making, ungoverned integrations become increasingly attractive targets.
Salesforce has clearly signaled a new direction: tighter control over connected apps, increased scrutiny of integrations, and architectural patterns that reinforce platform trust.
Organizations should reassess their third-party applications now—particularly those that can process data autonomously or at scale. As with mobile applications that continuously collect location data, visibility and consent matter far more than most teams realize.
AGENTFORCE AND THE NEXT PHASE OF CRM
Let’s get to what’s remarkable about Salesforce: Agentforce is quickly becoming the next “killer app” for CRM. The greatest showstoppers right now are your own data quality, lack of metadata and guardrails, and your risk exposure from external connections.
Once you’ve addressed these issues, the sky’s the limit for your Agentforce automation.
⎯ Fred Widarsson, Founder RealZips
Here’s why: Most Salesforce customers organize their data in a very similar architecture. We’ve worked with hundreds of Salesforce Orgs, and roughly 90% use the Salesforce infrastructure in almost identical ways. Therefore, emerging Agentforce solutions designed for the Salesforce infrastructure will soon empower most AI-ready customers.
Fortify your Salesforce Security
Learn about the security risks and run a Risk Assessment
Security preparation is no longer optional. Organizations should begin by understanding current exposure and establishing governance around integrations and automation.
Recommended resources:
- Salesforce Trust – “Security Advisory: Unusual Activity in a Third-Party Connected App“
- Salesforce Blog – “Get Ready: Changes to Connected App Usage Restrictions …”
- Valence Security – “Salesforce OAuth Token Breach: What Every Security Team Must Know”
- Fortra: “Salesforce Data Breach: What You Need to Know“
- Salesforce Ben – “New Salesforce Data Breach? CSM Software Gainsight Compromise”
- Salesforce Help: “Perform a Guided Risk Assessment“
- Salesforce Help: “New connected apps can no longer be created in Spring ’26”
Next Steps
The RealZips team has extensive experience delivering 100% Salesforce-native, enterprise-grade solutions across mission-critical environments. Organizations evaluating geolocation, market intelligence, metadata enrichment, mapping, or territory applications should carefully assess whether those tools introduce unnecessary OAuth or off-platform risk.
If you would like to discuss native-architecture best practices and risk-reduction strategies, schedule a meeting to explore next steps: